Behavioral task
behavioral1
Sample
3c64dcea8069c750fb2a1427c40fc490_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
3c64dcea8069c750fb2a1427c40fc490_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3c64dcea8069c750fb2a1427c40fc490_JaffaCakes118
-
Size
248KB
-
MD5
3c64dcea8069c750fb2a1427c40fc490
-
SHA1
90180d4e49532fa156078f504fb2931f374c46ba
-
SHA256
4138c7de57ec17d3311d1e6596bcd808f56c98c598c1fb387a3aa9a06fb283b6
-
SHA512
485f08ab067927249d95f76ef9b947c1323169df9cb7373bb2916e0fe2b8065e1d4980910021207a5f0f544bb4ed138dc396c4c0e27bf9c66555114b49ea57e6
-
SSDEEP
3072:qyWefGKx1iHMBBclb8BNNNTLEF+mPP2Up4YgZT23Q1EdXlMkLfVyg9J2fWWSgG5A:qyBkQc98BBIFt204LGQ1EdX6k5/9Jnk
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3c64dcea8069c750fb2a1427c40fc490_JaffaCakes118
Files
-
3c64dcea8069c750fb2a1427c40fc490_JaffaCakes118.exe windows:4 windows x86 arch:x86
e27e45030cd41886a2b0cd2aecee8897
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
user32
CharPrevA
CharUpperW
CharNextA
CharUpperA
oleaut32
SysStringByteLen
VariantCopy
VariantClear
SysAllocString
SysFreeString
advapi32
RegQueryValueExA
RegCloseKey
RegOpenKeyExA
msvcrt
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
__p___initenv
exit
_XcptFilter
_exit
?terminate@@YAXXZ
_onexit
__dllonexit
??1type_info@@UAE@XZ
_except_handler3
_beginthreadex
fprintf
memcpy
fputc
fputs
fflush
fgetc
fclose
_iob
free
malloc
memmove
strlen
memcmp
_purecall
__CxxFrameHandler
_CxxThrowException
_isatty
_fileno
kernel32
VirtualAlloc
GetTickCount
VirtualFree
WaitForSingleObject
SetEvent
InitializeCriticalSection
FileTimeToDosDateTime
GetProcessTimes
LocalFree
GetSystemTime
SystemTimeToFileTime
OpenFileMappingA
MapViewOfFile
UnmapViewOfFile
OpenEventA
GetStdHandle
GetModuleHandleA
GlobalMemoryStatus
GetSystemInfo
FileTimeToSystemTime
CompareFileTime
GetProcAddress
GetCurrentProcess
SetEndOfFile
WriteFile
ReadFile
SetFilePointer
GetFileSize
CreateFileA
FindNextFileW
FindNextFileA
FindFirstFileW
FindFirstFileA
FindClose
GetTempFileNameW
GetTempFileNameA
GetTempPathW
GetTempPathA
SearchPathW
SearchPathA
SetConsoleCtrlHandler
FileTimeToLocalFileTime
GetCommandLineW
SetFileApisToOEM
GetVersionExA
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
MultiByteToWideChar
WideCharToMultiByte
GetLastError
FreeLibrary
LoadLibraryExA
LoadLibraryA
AreFileApisANSI
GetModuleFileNameA
GetCurrentDirectoryW
FormatMessageA
FormatMessageW
GetWindowsDirectoryA
GetWindowsDirectoryW
CloseHandle
SetFileTime
CreateFileW
SetLastError
SetFileAttributesA
RemoveDirectoryA
MoveFileA
SetFileAttributesW
RemoveDirectoryW
MoveFileW
CreateDirectoryA
CreateDirectoryW
DeleteFileA
DeleteFileW
lstrlenA
GetFullPathNameA
GetFullPathNameW
GetCurrentDirectoryA
SetCurrentDirectoryA
SetCurrentDirectoryW
Sections
.text Size: 111KB - Virtual size: 111KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 22KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 784B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: 104KB - Virtual size: 252KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE